There's room for both ideas. This one has the benefit of being stupid simple to implement and maintain. In 10 minutes I can throw this together for all of our

There's room for both ideas. This one has the benefit of being stupid simple to implement and maintain. In 10 minutes I can throw this together for all of our login stuff. But a fully automated password changing system/API? That's not exactly as "maintenance free". Now you are maintaining a full API separate from your normal routines, and it's in an area that I always advocate for simplicity since subtle mistakes can mean compromised accounts. And the "fully automated" API would also have to work with "multi-factor" systems, which alone make everything more complicated to cover all the different ways it's done. Don't let the possibility of a better solution kill the benefits of this simpler one.